import type { McpServerConfig } from "../shared/types.js";
/**
 * GRS-018 hardening (§3a) — env-scrub wrap for THIRD-PARTY MCP servers.
 *
 * The gateway boot exports JINN_GATEWAY_TOKEN onto its own process.env so every
 * engine child (the employee request path) inherits it — load-bearing, HELD.
 * But the vendor CLIs that spawn MCP stdio servers pass their FULL environment
 * to those servers (empirically: claude forwards 77 keys incl. the token, grok
 * 78 — see GRS-018-credential-scope-analysis.md). A third-party server process
 * (npm supply chain) then holds a gateway credential it never needed.
 *
 * We can't change the vendor CLI's spawn policy, and we must NOT strip the
 * ENGINE process env (that breaks the employee curl path). The one point jinn
 * controls uniformly is the resolved server SPEC. So every non-builtin stdio
 * server's `command` is replaced with a tiny node launcher ({@link
 * SCRUB_ENTRY_BASENAME}) that deletes JINN_GATEWAY_TOKEN from its own env and
 * then execs the real command — the child third-party server never sees the
 * token. The builtin `jinn` server is EXEMPT: its inherited token is the proven
 * auth path (GRS-018 item 2), and it is jinn's own trusted code.
 *
 * The non-secret JINN_GATEWAY_URL is deliberately NOT stripped (some servers
 * legitimately want a local URL, and it carries no secret).
 *
 * Belt-and-braces across engines: claude reads the wrapped spec from its
 * --mcp-config file; codex/grok already spawn MCP servers with a clean/filtered
 * env (so the wrap is redundant but harmless there); hermes filters too. Keeping
 * ONE wrapped shape in the resolver means the guarantee holds no matter which
 * engine consumes the set, and future third-party attach paths inherit it free.
 */
/** Basename of the compiled launcher (sits next to this module in dist). */
export declare const SCRUB_ENTRY_BASENAME = "scrub-entry.js";
/**
 * Return a copy of a resolved server map where every NON-builtin stdio server's
 * command is wrapped in the env-scrub launcher. Pure — never mutates the input,
 * and leaves the builtin `jinn` server and URL-transport servers by reference.
 */
export declare function wrapServersWithScrub(servers: Record<string, McpServerConfig>): Record<string, McpServerConfig>;
//# sourceMappingURL=env-scrub.d.ts.map